Qilin ransomware group lists www.ecodemolizionisrl.com on its leak site

• Ransomware group: Qilin
• Country: Italy
• Sector: Manufacturing
• Announcement date: August 22, 2025

Qilin ransomware group claims breach of Eco Demolizioni

The Qilin ransomware group has officially listed the Italian organization operating under the domain www.ecodemolizionisrl.com on its dedicated leak site. According to the announcement made on August 22, 2025, the threat actor group claims to have successfully infiltrated the company's internal network. The group has asserted that they have obtained sensitive data from the organization and has issued threats to publish the stolen information publicly if their demands are not met.

This type of announcement is a hallmark of modern ransomware operations. In these scenarios, threat actors typically employ a strategy known as double extortion. This method involves not only encrypting a victim's systems to disrupt business operations but also exfiltrating sensitive information prior to encryption. By threatening to leak the stolen data on a public platform, the attackers create additional pressure on the victim, moving the leverage from mere operational downtime to severe reputational and legal consequences.

Details of the alleged data exfiltration

The announcement provided by the Qilin group includes several critical remarks regarding the company's business operations. Alongside these comments, the group has published samples of documents that they claim were exfiltrated from the organization's internal systems. These samples are intended to serve as proof of the breach and to increase the pressure on the target organization.

The specific types of data mentioned in the leak site announcement include:

• Financial documents
• Contracts
• Identity information

While the group has provided samples to validate their claims, no specific information was provided regarding the total size of the stolen data or the exact number of files compromised during the incident. Furthermore, there was no information provided regarding a specific ransom demand or the exact date the initial intrusion occurred, as the announcement and the claimed attack date are both listed as August 22, 2025.

About Eco Demolizioni S.r.l.

Eco Demolizioni S.r.l. is an Italy-based company that operates across several industrial and environmental sectors. The organization's professional activities include the demolition of large buildings, quarrying, land reclamation, and beach cleaning services. Given the nature of these operations, the company maintains various business relationships and handles significant logistical and administrative documentation.

Potential impact and security implications

The exposure of the data claimed by the Qilin group carries significant risks for the organization and its stakeholders. The presence of identity information and contracts suggests that the breach could lead to identity theft or highly targeted phishing attacks aimed at the company's employees and business partners. When attackers possess such specific details, they can craft much more convincing social engineering campaigns to further compromise the network or defraud partners.

Furthermore, because Eco Demolizioni operates within Italy, this breach may trigger legal and administrative sanctions under the EU General Data Protection Regulation (GDPR). The exposure of financial data also poses a threat to the company's commercial reputation and could disrupt its ongoing operational processes. Given the historical activity patterns of the Qilin group, there is a possibility that the exfiltrated data may be shared more broadly across the dark web in the future.

For organizations operating in the manufacturing and industrial sectors, such incidents highlight the necessity of robust cybersecurity frameworks. Defensive measures typically include implementing multi-factor authentication, maintaining rigorous patch management schedules, and conducting regular offline backups to mitigate the impact of encryption-based attacks. Additionally, monitoring for unauthorized data exfiltration and implementing strict access controls can help reduce the likelihood of a successful breach and limit the volume of sensitive information that can be stolen.